[Ethereal-dev] Dissection of file data in Write AndX Request message

[dheitmueller <dheitmueller@xxxxxxxxxxx>]

Hello,

I asked a similar question last month regarding the ability to read SMBreadX requests.  My problem was that I did not have Ethereal properly configured to dissect the trace.  

It is likely that I'm having a similar problem here.

Please look at the attached trace.  I am attempting to dissect the DCE payload in frame 5.  However, it is encapsulated in a WriteAndX request as the "file data". 

Is there any way to get Ethereal to interpret the "file data" field as DCE/RPC?

I have enabled the following options to no success:

DCERPC - Desegment all DCE/RPC over TCP
DCERPC - Reassemble DCE/RPC fragments
NBSS- Desegment all NBSS packets spanning multiple TCP segments
NetBIOS - Defragment all NetBIOS messages spanning multiple frames
SMB - Reassemble SMB Transaction Payload
SMB - Reassemble DCERPC over SMB
TCP - Allow subdissector to desegment TCP streams

I suspect I'm probably doing something wrong, and feel rather stupid asking a very similar question as a month earlier.  Any advice that can be offered would be greatly appreciated.

Thanks in advance,

Devin Heitmueller
Senior Software Engineer
Netilla Networks Inc

Attachment: nt42n2000passchange2.eth
Description: Binary data